CVE-2026-90041

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: sony: clean up device list on probe failure

sony_input_configured() adds some controllers to sony_device_list before

HID core registers their input devices. input_register_device() can fail

after the callback returns successfully. sony_probe() then observes that

HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware.

The devres-managed sony_sc is freed while its list node remains linked, so

the next matching controller traverses freed memory.

Initialize the list node and device ID to inactive states. Make list

removal idempotent and run the driver-private cleanup on every probe

failure path. This also makes a second cleanup safe when

sony_input_configured() already unwound a partial initialization before

sony_probe() handles the missing input claim.

Found by 0sec (https://0sec.ai) using automated source analysis;

verified against the HID input registration and probe unwind paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References